SMS Alert CVE-2026-94257

Requires the SMS Alert plugin's OTP-based password-reset (SMS login/reset) feature to be enabled and configured on the target WordPress site; where that feature is not activated, the flaw is not reachable. The attacker must control a phone number to receive and verify a one-time code and must know or guess a valid target account identifier (such as the administrator username). No authentication is required (PR:N) and no victim interaction is needed (UI:N); the limiting factors are the non-universal OTP-reset configuration and knowledge of the target account, which is why complexity is elevated.

This is a genuine high-priority account-takeover flaw rather than an inflated high-CVSS issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) correctly captures an unauthenticated, network-reachable logic flaw with full confidentiality, integrity, and availability impact (C:H/I:H/A:H) because the end state is takeover of an administrator account, i.e. full control of the WordPress site. CWE-269 (improper privilege management) is consistent with the described authorization gap: the OTP reset never binds the verified phone number to the account being changed. The one mitigating signal is AC:H, which is reasonable - exploitation depends on the plugin's OTP-based password-reset/login feature being enabled and on the attacker knowing a valid target account identifier (e.g. the admin username), so it is not a point-and-click default-config RCE. No EPSS score, CISA KEV entry, or public PoC is present in the provided data, so there is no evidence of active or automated exploitation yet; the finding is credibly reported by WPScan and a vendor patch exists. Net: treat as a priority patch for any site running SMS Alert with OTP reset enabled, but current real-world exploitation appears unproven rather than widespread.

An attacker targets a WordPress site using SMS Alert's OTP-based password reset, initiates a reset for the administrator account, and completes verification using a one-time code sent to a phone number the attacker controls rather than the admin's registered number. Because the plugin never ties the verified phone to the targeted account, the attacker sets a new administrator password and logs in. No public exploit code is identified at time of analysis, though the flaw is a straightforward logic bypass once the OTP feature is in use.